ELECTRONIC DATA TRANSMISSION AND RECEPTION SYSTEM 

BACKGROUND OF THE INVENTION 

1. Field of the Invention: 

5 The present invention relates to an electronic 

data transmission and reception system, and more particu- 
larly to an electronic data transmission and reception 
system for confirming whether electronic data transmitted 
from a transmitting apparatus have been received by a re- 
10 ceiving apparatus or not, 

2. Description of the Related Art: 

There are known systems for transmitting elec- 
tronic data or electronic texts (e.g., see patent docu- 
ments 1, 2, 3, 4 below) . 

15 In a system wherein a transmitting apparatus 

transmits electronic data via a relay device to a receiv- 
ing apparatus, when the transmitting apparatus transmits 
electronic data to the receiving apparatus, a sender who 
uses the transmitting apparatus is required to communicate 

20 with the relay device from the transmitting apparatus and 
collect a log from the relay device in order to confirm 
whether the electronic data transmitted from the transmit- 
ting apparatus have been received by the receiving appara- 
tus or not. There has been desired in the art a system 

25 for guaranteeing electronic data transmitted from a trans- 



mitting apparatus until they are received by a receiving 

apparatus . 

Patent document 1: 

Japanese laid-open patent publication No, 2000-78235; 
5 Patent document 2 : 

Japanese laid-open patent publication No. 2000-183866; 
Patent document 3 : 

Japanese laid-open patent publication No. 2002-7288; and 
Patent document 4 : 
10 Japanese laid-open patent publication No. 2002-183491. 

SUMMARY OF THE INVENTION 
It is an object of the present invention to 
provide an electronic data transmission and reception sys- 
tem for guaranteeing electronic data transmitted from a 
15 transmitting apparatus until they are received by a re- 
ceiving apparatus . 

Another object of the present invention is to 
provide an electronic data transmission and reception sys- 
tem which is capable of verifying a route along which 
20 electronic data are received by a receiving apparatus. 

Still another object of the present invention 
is to provide an electronic data transmission and recep- 
tion system which is capable of detecting a falsification 
of electronic data. 
25 Yet another object of the present invention is 

to provide an electronic data transmission and reception 



2 



system which protects itself against illegal access by a 
hacker . 

Means for achieving the above objects of the 
present invention will be described below using reference 
5 numerals and characters that appear in the detailed de- 
scription of the embodiment of the present invention. 
These reference numerals and characters are added only to 
clarify the relationship between the description of claims 
and the description of the embodiment of the present in- 
10 vention, and should not be used in the interpretation of 

the scope of claims. 

An electronic data transmission and reception 
system according to the present invention comprises n 
first through nth (n is an integer of 2 or greater) appa- 

15 ratus [5-1 through 5-n], a transmitting apparatus [1], and 
a receiving apparatus [2] . The n apparatus [5-1 through 
5-n], the transmitting apparatus [1] , and the receiving 
apparatus [2] are connected to a network [100] . The 
transmitting apparatus [1] transmits first electronic data 

20 to the first apparatus [5-1] . The receiving apparatus [2] 
receives (n+l)th electronic data from the nth apparatus 
[5-n] . A jth (j is an integer satisfying 1 < j ^ n) appa- 
ratus generates (j+l)th electronic data which comprise jth 
electronic data with a signature assigned thereto for 

25 identifying the jth apparatus, and transmits the (j+1) 

electronic data to a (j+l)th apparatus. When j is n, an 



3 



(n+l)th apparatus corresponds to the receiving apparatus 
[2] . 

The electronic data may, for example, be elec- 
tronic mail containing a document regarding a business be- 
5 tween parties, with an image or images possibly attached 
to the electronic mail. Alternatively, the electric mail 
may be financial electronic data or civilian electronic 
data instead of electronic data regarding a business be- 
tween parties. 

10 With the electronic data transmission and re- 

ception system according to the present invention, because 
of signatures that are generated until the (j+l)th elec- 
tronic data are generated, the sender who has transmitted 
the first electronic document with the transmitting appa- 

15 ratus [1] is unable to repudiate that the sender has 

transmitted the first electronic document (transmission 
denial) . Consequently, the electronic data transmission 
and reception system according to the present invention 
guarantees the first electronic data transmitted by the 

20 transmitting apparatus [1] until the first electronic data 
are received by the receiving apparatus [2] . 

In the electronic data transmission and recep- 
tion system according to the present invention, if the jth 
apparatus is the first apparatus [5-1], then the transmit- 

25 ting apparatus [1] transmits the first electronic data and 
a sender authenticator which authenticates the transmis- 
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sion of the first electronic data, to the first apparatus 
[5-1], and the first apparatus generates second electronic 
data which comprise the first electronic data and the 
sender authenticator with a signature of the first appara- 
5 tus [5-1] assigned thereto, and transmits the second elec- 
tronic data to a second apparatus [5-2] . 

With the electronic data transmission and re- 
ception system according to the present invention, because 
of the sender authenticator corresponding to the signature 

10 of the transmitting apparatus [1] and signatures assigned 
until the (j+l)th electronic data are generated, the 
sender who has transmitted the first electronic document 
with the transmitting apparatus [1] is unable to repudiate 
that the sender has transmitted the first electronic docu- 

15 ment (transmission denial) . Consequently, the electronic 
data transmission and reception system according to the 
present invention guarantees the first electronic data 
transmitted by the transmitting apparatus [1] until the 
first electronic data are received by the receiving appa- 

20 ratus [2] . 

The electronic data transmission and reception 
system according to the present invention further com- 
prises a memory apparatus [3] for use with the transmit- 
ting apparatus [1] . The first apparatus [5-1] generates 
25 transmission proof data which comprise the first elec- 
tronic data and the sender authenticator with the signa- 
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ture of the first apparatus [5-1] assigned thereto, and 
transmits the transmission proof data to the transmitting 
apparatus [1] . The transmitting apparatus [1] stores the 
transmission proof data transmitted from the first appara- 
5 tus into the memory apparatus [3] for use with the trans- 
mitting apparatus [1] . 

With the electronic data transmission and re- 
ception system according to the present invention, since 
the transmission proof data with the signature of the 

10 first apparatus [5-1] assigned thereto is stored in the 

memory apparatus [3] for use with the transmitting appara- 
tus [1], the sender who has transmitted the first elec- 
tronic document with the transmitting apparatus [1] is un- 
able to repudiate that the sender has transmitted the 

15 first electronic document (transmission denial) . 

In the electronic data transmission and recep- 
tion system according to the present invention, if the jth 
apparatus is the first apparatus [5-1] , the nth apparatus 
[5-n] transmits a notification of the reception of nth 

20 electronic data to the receiving apparatus [2] when the 

nth apparatus receives [5-n] the nth electronic data from 
an (n-l)th apparatus. The receiving apparatus [2] trans- 
mits a receiver authenticator which authenticates the re- 
ception of the nth electronic data in response to the no- 

25 tification of the reception of nth electronic data. The 
nth apparatus [5-n] generates (n+l)th electronic data 
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which comprise the nth electronic data and the receiver 
authenticator with a signature of the nth apparatus [5-n] 
assigned thereto, and transmits the (n+l)th electronic 
data to the receiving apparatus [2] . 
5 With the electronic data transmission and re- 

ception system according to the present invention, because 
of the sender authenticator and signatures assigned until 
the (j+l)th electronic data are generated, the sender who 
has transmitted the first electronic document with the 

10 transmitting apparatus [1] is unable to repudiate that the 
sender has transmitted the first electronic document 
(transmission denial) . With the electronic data transmis- 
sion and reception system according to the present inven- 
tion, furthermore, the receiver who uses the receiving ap- 

15 paratus [2] is unable to repudiate that the receiver has 

received the first electronic document (reception denial) . 
Consequently, the electronic data transmission and recep- 
tion system according to the present invention guarantees 
the first electronic data transmitted by the transmitting 

20 apparatus [1] until the first electronic data are received 
by the receiving apparatus [2] . 

The electronic data transmission and reception 
system according to the present invention further com- 
prises a memory apparatus [4] for use with the receiving 

25 apparatus [2] . The receiving apparatus [2] stores the 

(n+l)th electronic data transmitted from the nth apparatus 
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[5-n] , into the memory apparatus [4] for use with the re- 
ceiving apparatus [2] . 

The (n+l)th electronic data comprise the sender 
authenticator, signatures of the n apparatus [5-1 through 
5 5-n] , and the first electronic data to which the receiver 
authentication is assigned. With electronic data trans- 
mission and reception system according to the present in- 
vention, inasmuch as the (n+l)th electronic data are 
stored in the memory apparatus [4], the receiver who uses 

10 the receiving apparatus [2] is unable to repudiate that 
the receiver has received the first electronic document 
(reception denial) . 

In the electronic data transmission and recep- 
tion system according to the present invention, the re- 

15 ceiving apparatus [2] comprises a database [18] of the re- 
ceiving apparatus [2] for storing the sender authenticator 
and signatures of the n apparatus [5-1 through 5-n] . The 
receiving apparatus [2] verifies that the transmitting ap- 
paratus [2] has transmitted the first electronic data. 

20 The receiving apparatus [2] fetches the nth electronic 

data and the receiver authenticator except the signature 
of the nth apparatus [5-n] assigned to the (n+l)th elec- 
tronic data. The receiving apparatus [2] fetches the jth 
electronic data except the signature assigned to the 

25 (j+l)th electronic data other than the (n+l)th electronic 
data and the second electronic data. The receiving appa- 



ratus [2] fetches the first electronic data and the sender 
authenticator except the signature of the first apparatus 
[5-1] assigned to the second electronic data. The receiv- 
ing apparatus [2] refers to the database [18] of the re- 
5 ceiving apparatus [2] for recognizing that the transmit- 
ting apparatus [1] has transmitted the first electronic 
data . 

If the receiving apparatus [2] properly con- 
firms (verifies) the (n+l)th electronic document, the nth 

10 electronic document, • * • , the second electronic document, 
and the first electronic document in that order, then the 
electronic data transmission and reception system accord- 
ing to the present invention guarantees that the first 
electronic document has been transmitted by the transmit- 

15 ting apparatus [1] . Furthermore, the receiving apparatus 
[2] can verify the route (the transmitting apparatus [1], 
the n apparatus [5-1 through 5-n] , and the receiving appa- 
ratus [2]) along which the first electronic document has 
been transmitted to the receiving apparatus [2], as the 

20 historical record of signatures. The sender can confirm 
the route off-line. The receiving apparatus [2] can con- 
firm off-line the route along which the first electronic 
document has been transmitted, without the need for commu- 
nicating with and collecting logs from the n apparatus [5- 

25 1 through 5-n] . Therefore, the n apparatus [5-1 through 
5-n] are not required to store logs, and do not need any 

9 



memory apparatus for storing logs. The electronic data 
transmission and reception system according to the present 
invention protects itself against illegal access by a 
hacker as the route is grasped by the receiving apparatus 
5 [2]. 

In the electronic data transmission and recep- 
tion system according to the present invention, the first 
apparatus [5-1] generates the second electronic data in 
which the signature of the first apparatus [5-1] is as- 

10 signed to a first time stamp that represents the time when 
the first apparatus [5-1] receives the sender authentica- 
tor from the transmitting apparatus [1] . The nth appara- 
tus [5-n] generates the (n+l)th electronic data in which 
the signature of the nth apparatus [5-n] is assigned to a 

15 second time stamp that represents the time when the nth 
apparatus [5-n] receives the receiver authenticator from 
the receiving apparatus [2] . The receiving apparatus [2] 
fetches the nth electronic data, the receiver authentica- 
tor, and the second time stamp except the signature of the 

20 nth apparatus [5-n] assigned to the (n+l)th electronic 

data. The receiving apparatus [2] fetches the first elec- 
tronic data, the sender authenticator, and the first time 
stamp except the signature of the first apparatus [5-1] 
assigned to the second electronic data. 

25 In the electronic data transmission and recep- 

tion system according to the present invention, the nth 

10 



apparatus [5-n] generates reception proof data which are 
electronic data comprising the nth electronic data and the 
receiver authenticator with the signature of the nth appa- 
ratus [5-n] assigned thereto, 
5 In the electronic data transmission and recep- 

tion system according to the present invention, the trans- 
mitting apparatus [1] comprises a database [18] of the 
transmitting apparatus [1] for storing signatures of the n 
apparatus [5-n] and the receiver authenticator. The 

10 transmitting apparatus [1] verifies that the receiving ap- 
paratus [2] has received the first electronic data based 
on the reception proof data from the nth apparatus [5-n] . 

The transmitting apparatus [1] fetches the nth 
electronic data and the receiver authenticator except the 

15 signature of the nth apparatus [5-n] assigned to the re- 
ception proof data. The transmitting apparatus [1] 
fetches the jth electronic data except the signature as- 
signed to the (j+l)th electronic data other than the re- 
ception proof data and the second electronic data. The 

20 transmitting apparatus [1] fetches the first electronic 

data and the sender authenticator except the signature of 
the first apparatus [5-1] assigned to the second elec- 
tronic data. The transmitting apparatus [1] refers to the 
database [18] of the transmitting apparatus [1] for recog- 

25 nizing that the first electronic data have been transmit- 
ted to the receiving apparatus [2] . 
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If the transmitting apparatus [1] properly con- 
firms (verifies) the reception proof data, the nth elec- 
tronic document, the second electronic document, and 
the first electronic document in that order, then the 
5 electronic data transmission and reception system accord- 
ing to the present invention guarantees that the first 
electronic document has been received by the receiving ap- 
paratus [2]. Furthermore, the transmitting apparatus [1] 
can verify the route (the transmitting apparatus [1], the 

10 n apparatus [5-1 through 5-n] , and the receiving apparatus 
[2]) along which the first electronic document has been 
transmitted to the receiving apparatus [2], as the his- 
torical record of signatures. The sender can confirm the 
route off-line. The transmitting apparatus [1] can con- 

15 firm off-line the route along which the first electronic 

document has been transmitted, without the need for commu- 
nicating with and collecting logs from the n apparatus [5- 
1 through 5-n] . Therefore, the n apparatus [5-1 through 
5-n] are not required to store logs, and do not need any 

20 memory apparatus for storing logs. The electronic data 

transmission and reception system according to the present 
invention protects itself against illegal access by a 
hacker as the route is grasped by the transmitting appara- 
tus [1]. 

25 The electronic data transmission and reception 

system according to the present invention further com- 
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prises a first electronic data memory apparatus [3/18] . 
The first electronic data memory apparatus [3/18] com- 
prises either the memory apparatus [3] for use with the 
transmitting apparatus [1] or the database [18] of the 
5 transmitting apparatus [1]. The transmitting apparatus 

[1] stores the first electronic data into the first elec- 
tronic data memory apparatus [3/18] before transmitting 
the first electronic data. When the transmitting appara- 
tus [1] fetches the first electronic data, the transmit- 

10 ting apparatus [1] refers to the first electronic data 

memory apparatus [3/18] to recognize that the first elec- 
tronic data have been transmitted to the receiving appara- 
tus [2] without being falsified. 

With the electronic data transmission and re- 

15 ception system according to the present invention, the 

transmitting apparatus [1] can detect a falsification of 
the first electronic data by comparing the fetched first 
electronic data with the first electronic data stored in 
the first electronic data memory apparatus [3/18] . 

20 In the electronic data transmission and recep- 

tion system according to the present invention, the nth 
apparatus [5-n] generates reception proof data which are 
electronic data comprising the nth electronic data and the 
receiver authenticator with the signature of the nth appa- 

25 ratus [5-n] assigned thereto, and transmits the reception 
proof data from which the first electronic data have been 
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deleted, to the transmitting apparatus [1] . The transmit- 
ting apparatus [1] adds the first electronic data stored 
in the first electronic data memory apparatus [3/18], to 
the reception proof data transmitted from the nth appara- 
5 tus [5-n], thereby restoring the reception proof data. 

In the electronic data transmission and recep- 
tion system according to the present invention, the first 
apparatus [5-1] generates the second electronic data in 
which the signature of the first apparatus [5-1] is as- 

10 signed to a first time stamp that represents the time when 
the first apparatus [5-1] receives the sender authentica- 
tor from the transmitting apparatus [1] . The nth appara- 
tus [5-n] generates the reception proof data in which the 
signature of the nth apparatus [5-n] is assigned to a sec- 

15 ond time stamp that represents the time when the nth appa- 
ratus [5-n] receives the receiver authenticator from the 
receiving apparatus [2] . The transmitting apparatus [1] 
fetches the nth electronic data, the receiver authentica- 
tor, and the second time stamp except the signature of the 

20 nth apparatus [5-n] assigned to the reception proof data. 
The transmitting apparatus [1] fetches the first elec- 
tronic data, the sender authenticator, and the first time 
stamp except the signature of the first apparatus [5-1] 
assigned to the second electronic data. 

25 The present invention offers the following ad- 

vantages : 
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The electronic data transmission and reception 
system according to the present invention guarantees the 
electronic data (the first electronic data) transmitted by 
transmitting and receiving apparatus 1 (transmitting appa- 
5 ratus 1) until the electronic data (the first electronic 

data) are received by transmitting and receiving apparatus 
2 (receiving apparatus 2) . 

With the electronic data transmission and re- 
ception system according to the present invention, trans- 
10 mitting and receiving apparatus 1 (transmitting apparatus 
1) and transmitting and receiving apparatus 2 (receiving 
apparatus 2) can verify the route along which the elec- 
tronic data (the first electronic data) are transmitted to 
transmitting and receiving apparatus 2 (receiving appara- 
15 tus 2) . 

With the electronic data transmission and re- 
ception system according to the present invention, trans- 
mitting and receiving apparatus 1 (transmitting apparatus 
1) can detect a falsification of the electronic data (the 
20 first electronic data) by comparing the electronic data 

(the first electronic data) with the electronic data (the 
' first electronic data) that is stored in memory apparatus 
3, 

The electronic data transmission and reception 
25 system according to the present invention protects itself 
against illegal access by a hacker because the route is 



15 



grasped by transmitting and receiving apparatus 1 (trans- 
mitting apparatus 1) and transmitting and receiving appa- 
ratus 2 (receiving apparatus 2) . 

The above and other objects, features, and ad- 
5 vantages of the present invention will become apparent 

from the following description with reference to the ac- 
companying drawings which illustrate an example of the 
present invention . 

BRIEF DESCRIPTION OF THE DRAWINGS 
10 Fig. 1 is a block diagram showing an arrange- 

ment of an electronic data transmission and reception sys- 
tem according to the present invention; 

Fig. 2 is a block diagram showing a concept of 
the electronic data transmission and reception system ac- 
15 cording to the present invention; 

Fig. 3 is a block diagram showing an arrange- 
ment of a transmitting and receiving apparatus of the 
electronic data transmission and reception system accord- 
ing to the present invention; 
20 Fig. 4 is a block diagram showing an arrange- 

ment of an accepting device of the electronic data trans- 
mission and reception system according to the present in- 
vention; 

Fig. 5 is a block diagram showing an arrange- 
25 ment of a relay device of the electronic data transmission 
and reception system according to the present invention; 
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Fig. 6 is a flowchart of an operation sequence 
of the electronic data transmission and reception system 
according to the present invention; 

Fig. 7 is a flowchart of an operation sequence 
5 of the electronic data transmission and reception system 
according to the present invention; 

Fig. 8 is a flowchart of an operation sequence 
of the electronic data transmission and reception system 
according to the present invention; 
10 Fig. 9 is a diagram illustrative of an elec- 

tronic document in the electronic data transmission and 
reception system according to the present invention; 

Fig. 10 is a diagram illustrative of an elec- 
tronic document in the electronic data transmission and 
15 reception system according to the present invention; 

Fig. 11 is a flowchart of an operation sequence 
of the electronic data transmission and reception system 
according to the present invention; 

Fig. 12 is a flowchart of an operation sequence 
20 of the electronic data transmission and reception system 
according to the present invention; 

Fig. 13 is a flowchart of an operation sequence 
of the electronic data transmission and reception system 
according to the present invention; and 
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Fig. 14 is a diagram illustrative of an elec- 
tronic document in the electronic data transmission and 
reception system according to the present invention. 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
5 Fig. 1 shows in block form an arrangement of an 

electronic data transmission and reception system accord- 
ing to the present invention. As shown in Fig. 1, the 
electronic data transmission and reception system accord- 
ing to the present invention comprises transmitting and 

10 receiving apparatus 1, 2, memory apparatus 3, memory appa- 
ratus 4, and n first through nth (n is an integer of 2 or 
greater) apparatus 5-1 through 5-n. Transmitting and re- 
ceiving apparatus 1, 2, first apparatus 5-1, second appa- 
ratus 5-2, third apparatus 5-3, fourth apparatus 5-4, 

15 and nth apparatus 5-n are connected to network 100. Mem- 
ory apparatus 3 is connected as a memory apparatus for 
transmitting and receiving apparatus 1 to transmitting and 
receiving apparatus 1. Memory apparatus 4 is connected as 
a memory apparatus for transmitting and receiving appara- 

20 tus 2 to transmitting and receiving apparatus 2. 

The electronic data transmission and reception 
system according to the present invention serves to guar- 
antee electronic data transmitted from transmitting and 
receiving apparatus 1 until they are received by receiving 

25 apparatus 2. Fig. 2 shows in block form a concept of the 
electronic data transmission and reception system accord- 
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ing to the present invention. For specifically describing 
the electronic data transmission and reception system ac- 
cording to the present invention, it is assumed that the 
integer n is 5, first apparatus 5-1 serves as accepting 
5 device 5-1, second apparatus 5-2 as relay device 5-2, 

third apparatus 5-3 as relay device 5-3, fourth apparatus 
5-4 as relay device 5-4, and nth apparatus 5-n as accept- 
ing device 5-5. Transmitting and receiving apparatus 1 
transmits electronic data to transmitting and receiving 

10 apparatus 2. Specifically, the electronic data are output 
from transmitting and receiving apparatus 1 through ac- 
cepting device 5-1, relay device 5-2, relay device 5-3, 
relay device 5-4, and accepting device 5-5 to transmitting 
and receiving apparatus 2 . 

15 The electronic data may, for example, be elec- 

tronic mail containing a document regarding a business be- 
tween parties, with an image or images possibly attached 
to the electronic mail. Alternatively, the electric mail 
may be financial electronic data or civilian electronic 

20 data instead of electronic data regarding a business be- 
tween parties. The electronic data refers to electronic 
data (electronic mail) containing a document, and will 
hereinafter be referred to as an electronic document. 

Fig. 3 shows in block form an arrangement of 

25 each of transmitting and receiving apparatus 1, 2. Each 
of transmitting and receiving apparatus 1, 2 comprises an 



information processing apparatus exemplified by a personal 
computer , a workstation, or the like. Each of transmit- 
ting and receiving apparatus 1, 2 includes transmitter 11, 
receiver 12, signature unit 13, signature verifier 14, 
5 electronic document verifier 15, electronic document gen- 
erator 16, and register 17, which are provided by a com- 
puter program, and database 18. To each of transmitting 
and receiving apparatus 1, 2, there is connected an input 
device (not shown) operable by the user for electronic 

10 document generator 16 to generate an electronic document. 
Signature unit 13 of each of transmitting and receiving 
apparatus 1, 2 serves to sign transmitting and receiving 
apparatus 1, 2 on an electronic document with a private 
key based on a public key system. Database 18 of trans- 

15 mitting and receiving apparatus 1 stores the signatures of 
accepting devices 5-1, 5-5, the signatures of relay de- 
vices 5-2, 5-3, 5-4, and the signature (an authenticator 
to be described later on) of transmitting and receiving 
apparatus 2, respectively as public key certificates. Da- 

20 tabase 18 of transmitting and receiving apparatus 2 stores 
the signature (an authenticator to be described later on) 
of transmitting and receiving apparatus 1, the signatures 
of accepting devices 5-1, 5-5, and the signatures of relay 
devices 5-2, 5-3, 5-4, respectively as public key certifi- 

25 cates. 
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Fig. 4 shows in block form an arrangement of 
each of accepting devices 5-1, 5-5. Each of accepting de- 
vices 5-1, 5-5 comprises an information processing appara- 
tus exemplified by a personal computer, a workstation, or 
the like. Each of accepting devices 5-1, 5-5 includes 
transmitter 21, receiver 22, signature unit 23, signature 
verifier 24, proof data generator 25, time stamp generator 
26, and saving controller 27, which are provided by a com- 
puter program, and database 28. Database 28 of accepting 
device 5-1 stores the signatures (authenticators to be de- 
scribed later on) of transmitting and receiving apparatus 
1, 2, the signatures of relay devices 5-2, 5-3, 5-4, and 
the signature of accepting device 5-5, respectively as 
public key certificates. Database 28 of accepting device 
5-5 stores the signatures (authenticators to be described 
later on) of transmitting and receiving apparatus 1, 2, 
the signature of accepting device 5-1, and the signatures 
of relay devices 5-2, 5-3, 5-4, respectively as public key 
certificates. Signature verifiers 24 of accepting devices 
5-1, 5-5 recognize, in advance, the addresses of transmit- 
ting and receiving apparatus 1, 2. Accepting devices 5-1, 
5-5 may be dispensed with, and their functions (transmit- 
ter 21, receiver 22, proof data generator 25, time stamp 
generator 26, signature unit 23, signature verifier 24, 
saving controller 27, and database 28) may be installed as 



an application in transmitting and receiving apparatus 1, 
2. 

Fig. 5 shows in block form an arrangement of 
each of relay devices 5-2, 5-3, 5-4. Each of relay de- 
vices 5-2, 5-3, 5-4 includes transmitter 31, receiver 32, 
signature unit 33, and signature verifier 34, which are 
provided by a computer program, and database 38. Database 
38 of relay device 5-2 stores the signatures of accepting 
devices 5-1, 5-5 and relay devices 5-3, 5-4, respectively, 
as public key certificates. Database 38 of relay device 
5-3 stores the signatures of accepting devices 5-1, 5-5 
and relay devices 5-2, 5-4, respectively, as public key 
certificates. Database 38 of relay device 5-4 stores the 
signatures of accepting devices 5-1, 5-5 and relay devices 
5-2, 5-3, respectively, as public key certificates. In 
the present embodiment, three relay devices are employed. 
However, in an environment where accepting devices 5-1, 5- 
5 can communicate directly with each other, relay devices 
5-2, 5-3, 5-4 are not required. If electronic documents 
are processed by a long process, then a plurality of relay 
devices are present in the electronic data transmission 
and reception system. 

Each of memory apparatus 3, 4 comprises, for 
example, a flexible disk, a hard disk, a database, a file 
server, or the like. Data (described later on) such as 
electronic documents, for example, are stored in each of 
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memory apparatus 3, 4 by transmitting and receiving appa- 
ratus 1, 2. 

Operation of the electronic data transmission 
and reception system according to the present invention 
5 will be described below. 

A first electronic document is output from 
transmitting and receiving apparatus 1 through accepting 
device 5-1, relay device 5-2, relay device 5-3, relay de- 
vice 5-4, and accepting device 5-5 to transmitting and re- 
10 ceiving apparatus 2. In the description of operation of 
the electronic data transmission and reception system ac- 
cording to the present invention, transmitting and receiv- 
ing apparatus 1 is referred to as transmitting apparatus 
1, and transmitting and receiving apparatus 2 as receiving 
15 apparatus 2. 

First, the generation of signature data (signa- 
ture, transmission authenticator , transmission proof data, 
reception authenticator, and reception proof data) which 
serve as proof for the transmission and reception of the 
20 first electronic document will be described below. 

As shown in Fig. 6, the sender who uses trans- 
mitting apparatus 1 acts on an input device thereof in or- 
der to generate the first electronic document to be sent 
to receiving apparatus 2. In response to the action on 
25 the input device, electronic document generator 16 of 
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transmitting apparatus 1 generates the first electronic 
document (step Al) . 

When the sender acts on the input device of 
transmitting apparatus 1 to send the first electronic 
document to receiving apparatus 2, transmitter 11 of 
transmitting apparatus 1 sends a transmission request for 
the first electronic document to accepting device 5-1 in 
response to the action on the input device (step A2) . 

Receiver 22 of accepting device 5-1 receives 
the transmission request for the first electronic document 
from transmitting apparatus 1. When receiver 22 receives 
the transmission request for the first electronic docu- 
ment, signature unit 23 of accepting device 5-1 generates 
a random train of characters. Transmitter 21 of accepting 
device 5-1 then transmits the generated random train of 
characters to transmitting apparatus 1 (step A3) . 

Receiver 12 of transmitting apparatus 1 re- 
ceives the random train of characters from accepting de- 
vice 5-1. Signature unit 13 of transmitting apparatus 1 
then signs the random train of characters received by re- 
ceiver 12 with a private key of transmitting apparatus 1, 
thus generating a sender authenticator which authenticates 
the transmission of the first electronic document (step 
A4) • 

Before transmitter 11 of transmitting apparatus 
1 transmits the first electronic document, register 17 of 



transmitting apparatus 1 stores the first electronic docu- 
ment as a storage electronic document in memory apparatus 
3 or database 18 of transmitting apparatus 1 (step A5) . 
In this example, the storage electronic document is stored 
5 in memory apparatus 3 . 

Transmitter 11 of transmitting apparatus 1 then 
transmits the first electronic document and the sender au- 
thenticator to accepting device 5-1 (step A6) . The first 
electronic document contains an address (address of re- 
10 ceiving apparatus 2) for sending the first electronic 
document to receiving apparatus 2. 

Receiver 22 of accepting device 5-1 receives 
the first electronic document and the sender authenticator 
from transmitting apparatus 1. When receiver 22 receives 
15 the first electronic document and the sender authentica- 
tor, time stamp generator 2 6 of accepting device 5-1 gen- 
erates a first time stamp representative of the time when 
the sender verifier from transmitting apparatus 1 is re- 
ceived (step A7) . 
20 At this time, signature verifier 24 of accept- 

ing device 5-1 refers to database 28 of accepting device 
5-1, and checks the sender authenticator against the pub- 
lic key certificate of transmitting apparatus 1 to deter- 
mine whether the sender authenticator matches the public 
25 key certificate of transmitting apparatus 1 or not (step 
A8) . 
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If the sender authenticator matches the public 
key certificate of transmitting apparatus 1, then proof 
data generator 25 of accepting device 5-1 adds the sender 
authenticator and the first time stamp to the first elec- 
5 tronic document, generating a hash value. Proof data gen- 
erator 25 of accepting device 5-1 signs the hash value 
with the private key of accepting device 5-1, generating 
transmission proof data which are electronic data compris- 
ing the first electronic document, the sender authentica- 

10 tor, and the first time stamp, with the signature of ac- 
cepting device 5-1 assigned thereto (step A9) . For 
generating such transmission proof data, the first time 
stamp may be dispensed with. Transmitter 21 of accepting 
device 5-1 then transmits the transmission proof data to 

15 transmitting apparatus 1 (step A10) . 

If the sender authenticator does not match the 
public key certificate of transmitting apparatus 1, then 
transmitter 21 of accepting device 5-1 transmits informa- 
tion indicative of the match failure to transmitting appa- 

20 ratus 1. Based on the information, transmitting apparatus 
1 transmits again the first electronic document and the 
sender authenticator to accepting device 5-1. Accepting 
device 5-1 checks the sender authenticator again. If the 
sender authenticator does not match the public key cer- 

25 tificate, then accepting device 5-1 transmits information 
indicating that the first electronic document cannot be 
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transmitted to transmitting apparatus 1 (these steps are 
not illustrated) . 

Receiver 12 of transmitting apparatus 1 re- 
ceives the transmission proof data from accepting device 
5 5-1. When receiver 12 receives the transmission proof 
data, signature verifier 14 of transmitting apparatus 1 
refers to database 18 of transmitting apparatus 1, and 
checks the signature of the transmission proof data 
against the public key certificate of accepting device 5-1 
10 to determine whether the signature of the transmission 

proof data matches the public key certificate of accepting 
device 5-1 or not (step All) . 

If the signature of the transmission proof data 
matches the public key certificate of accepting device 5- 
15 1, then register 17 of transmitting apparatus 1 stores the 
transmission proof data in memory apparatus 3 (step A12) . 
With the electronic data transmission and reception system 
according to the present invention, since the transmission 
proof data with the signature of accepting device 5-1 as- 
20 signed thereto is stored in memory apparatus 3, the sender 
who has transmitted the first electronic document with 
transmitting apparatus 1 is unable to repudiate that the 
sender has transmitted the first electronic document 
(transmission denial) . 
25 If the signature of the transmission proof data 

does not match the public key certificate of accepting de- 
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vice 5-1, then transmitting apparatus 1 transmits again 
the first electronic document and the sender authenticator 
to accepting device 5-1. Accepting device 5-1 checks the 
sender authenticator again. If the sender authenticator 
does not match the public key certificate, then accepting 
device 5-1 transmits information indicating that the first 
electronic document cannot be transmitted to transmitting 
apparatus 1 (these steps are not illustrated) . 

Signature unit 23 of accepting device 5-1 adds 
the sender authenticator and the first time stamp to the 
first electronic document, generating a hash value. Proof 
data generator 25 of accepting device 5-1 signs the hash 
value with the private key of accepting device 5-1, gener- 
ating a second electronic document comprising the first 
electronic document, the sender authenticator, and the 
first time stamp, with the signature of accepting device 
5-1 assigned thereto (step A13, see Fig. 9). For generat- 
ing such a second electronic document, the first time 
stamp may be dispensed with. 

Transmitter 21 of accepting device 5-1 then 
transmits the second electronic document to relay device 
5-2 (step A14) . The second electronic document contains 
the address of receiving apparatus 2. 

As shown in Fig. 7, receiver 32 of relay device 
5-2 receives the second electronic document from accepting 
device 5-1. When receiver 32 receives the second elec- 
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tronic document, signature verifier 34 of relay device 5-2 
refers to database 38 of relay device 5-2, and checks the 
signature of the second electronic document against the 
public key certificate of accepting device 5-1 to deter- 
5 mine whether the signature of the second electronic docu- 
ment matches the public key certificate of accepting de- 
vice 5-1 or not (step A15) . Signature verifier 34 checks 
the signature of the second electronic document to confirm 
whether it is alright to relay the second electronic docu- 
10 ment or not. However, if the relationship between accept- 
ing device 5-1 and relay device 5-2 is of mutual confi- 
dence, then the signature verification may be dispensed 
with. 

If the signature of the second electronic docu- 
15 ment matches the public key certificate of accepting de- 
vice 5-1, then signature unit 33 of relay device 5-2 signs 
the second document with the private key of relay device 
5-2, generating a third electronic document that comprises 
the second electronic document with the signature of relay 
20 device 5-2 assigned thereto (step A16, see Fig. 9) . 

Transmitter 31 of relay device 5-2 transmits the third 
electronic document to relay device 5-3 (step A17) . The 
third electronic document contains the address of receiv- 
ing apparatus 2 . 

25 If the signature of the second electronic docu- 

ment does not match the public key certificate of accept- 
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ing device 5-1, then transmitter 31 of accepting device 5- 
2 transmits information indicative of the match failure to 
accepting device 5-1. Based on the information, accepting 
device 5-1 transmits again the second electronic document 
5 to relay device 5-2. Relay device 5-2 checks the signa- 
ture of the second electronic document again. If the sig- 
nature of the second electronic document does not match 
the public key certificate, then relay device 5-2 trans- 
mits information indicating that the second electronic 

10 document (the first electronic document) cannot be trans- 
mitted to transmitting apparatus 1 (these steps are not 
illustrated) . 

Receiver 32 of relay device 5-3 receives the 
third electronic document from accepting device 5-2. When 

15 receiver 32 receives the third electronic document, signa- 
ture verifier 34 of relay device 5-3 refers to database 38 
of relay device 5-3, and checks the signature of the third 
electronic document against the public key certificate of 
accepting device 5-2 to determine whether the signature of 

20 the third electronic document matches the public key cer- 
tificate of accepting device 5-2 or not (step A18) . Sig- 
nature verifier 34 checks the signature of the third elec- 
tronic document to confirm whether it is alright to relay 
the third electronic document or not. However, if the re- 

25 lationship between accepting device 5-2 and relay device 
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5-3 is of mutual confidence, then the signature verifica- 
tion may be dispensed with. 

If the signature of the third electronic docu- 
ment matches the public key certificate of accepting de- 
vice 5-2, then signature unit 33 of relay device 5-3 signs 
the third document with the private key of relay device 5- 
3, generating a fourth electronic document that comprises 
the third electronic document with the signature of relay 
device 5-3 assigned thereto (step A19, see Fig. 9). 
Transmitter 31 of relay device 5-3 transmits the fourth 
electronic document to relay device 5-4 (step A20) . The 
fourth electronic document contains the address of receiv- 
ing apparatus 2. 

If the signature of the third electronic docu- 
ment does not match the public key certificate of accept- 
ing device 5-2, then transmitter 31 of accepting device 5- 
3 transmits information indicative of the match failure to 
accepting device 5-2. Based on the information, accepting 
device 5-2 transmits again the third electronic document 
to relay device 5-3. Relay device 5-3 checks the signa- 
ture of the third electronic document again. If the sig- 
nature of the third electronic document does not match the 
public key certificate, then relay device 5-3 transmits 
information indicating that the third electronic document 
(the first electronic document) cannot be transmitted to 
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transmitting apparatus 1 (these steps are not illus- 
trated) . 

Receiver 32 of relay device 5-4 receives the 
fourth electronic document from accepting device 5-3. 
When receiver 32 receives the fourth electronic document, 
signature verifier 34 of relay device 5-4 refers to data- 
base 38 of relay device 5-4, and checks the signature of 
the fourth electronic document against the public key cer- 
tificate of accepting device 5-3 to determine whether the 
signature of the fourth electronic document matches the 
public key certificate of accepting device 5-3 or not 
(step A21) . Signature verifier 34 checks the signature of 
the fourth electronic document to confirm whether it is 
alright to relay the fourth electronic document or not. 
However, if the relationship between accepting device 5-3 
and relay device 5-4 is of mutual confidence, then the 
signature verification may be dispensed with. 

If the signature of the fourth electronic docu- 
ment matches the public key certificate of accepting de- 
vice 5-3, then signature unit 33 of relay device 5-4 signs 
the fourth document with the private key of relay device 
5-4, generating a fifth electronic document that comprises 
the fourth electronic document with the signature of relay 
device 5-4 assigned thereto (step A22, see Fig. 9) . 
Transmitter 31 of relay device 5-4 transmits the fifth 
electronic document to relay device 5-5 (step A23) . The 
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fifth electronic document contains the address of receiv- 
ing apparatus 2 . 

If the signature of the fourth electronic docu- 
ment does not match the public key certificate of accept- 
ing device 5-3, then transmitter 31 of accepting device 5- 
4 transmits information indicative of the match failure to 
accepting device 5-3. Based on the information, accepting 
device 5-3 transmits again the fourth electronic document 
to relay device 5-4. Relay device 5-4 checks the signa- 
ture of the fourth electronic document again. If the sig- 
nature of the fourth electronic document does not match 
the public key certificate, then relay device 5-4 trans- 
mits information indicating that the fourth electronic 
document (the first electronic document) cannot be trans- 
mitted to transmitting apparatus 1 (these steps are not 

illustrated) . 

As shown in Fig. 8, receiver 22 of accepting 
device 5-5 receives the fifth electronic document from re- 
lay device 5-4. When receiver 32 receives the fifth elec- 
tronic document, signature verifier 24 of accepting device 
5-5 refers to database 28 of accepting device 5-5, and 
checks the signature of the fifth electronic document 
against the public key certificate of relay device 5-4 to 
determine whether the signature of the fifth electronic 
document matches the public key certificate of relay de- 
vice 5-4 or not. Signature verifier 24 of accepting de- 
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vice 5-5 refers to database 28 of accepting device 5-5 to 
confirm whether the fifth electronic document is destined 
for receiving apparatus 2 or not based on the address con- 
tained in the fifth electronic document (step A24) . 

If the signature of the fifth electronic docu- 
ment matches the public key certificate of relay device 5- 
4, then transmitter 21 of accepting device 5-5 transmits a 
reception acknowledgment indicating that the fifth elec- 
tronic document has been received to receiving apparatus 2 
(step A25) . 

If the signature of the fifth electronic docu- 
ment does not match the public key certificate of relay 
device 5-4, then transmitter 21 of accepting device 5-5 
transmits information indicative of the match failure to 
relay device 5-4. Based on the information, accepting de- 
vice 5-4 transmits again the fifth electronic document to 
accepting device 5-5, Accepting device 5-5 checks the 
signature of the fifth electronic document again. If the 
signature of the fifth electronic document does not match 
the public key certificate, then accepting device 5-5 
transmits information indicating that the fifth electronic 
document (the first electronic document) cannot be trans- 
mitted to transmitting apparatus 1 (these steps are not 
illustrated) . 

Receiver 12 of receiving apparatus 2 receives 
the reception acknowledgment from accepting device 5-5. 



When receiver 12 receives the reception acknowledgment, 
transmitter 11 of receiving apparatus 2 transmits a recep- 
tion request for the fifth electronic document to accept- 
ing device 5-5 (step A26) . 
5 Receiver 22 of accepting device 5-5 receives 

the reception request for the fifth electronic document 
from receiving apparatus 2. When receiver 22 receives the 
reception request for the fifth electronic document, sig- 
nature unit 23 of accepting device 5-5 generates a random 

10 train of characters. Transmitter 21 of accepting device 
5-5 then transmits the generated random train of charac- 
ters to receiving apparatus 2 (step A27). 

Receiver 12 of receiving apparatus 2 receives 
the random train of characters from accepting device 5-5, 

15 Signature unit 13 of receiving apparatus 2 then signs the 
random train of characters received by receiver 12 with a 
private key of receiving apparatus 2, thus generating a 
receiver authenticator which authenticates the reception 
of the fifth electronic document (step A28) . 

20 Transmitter 11 of receiving apparatus 2 trans- 

mits the receiver authenticator to accepting device 5-5 
(step A29) . 

Receiver 22 of accepting device 5-5 receives 
the receiver authenticator from receiving apparatus 2. 
25 When receiver 22 receives the receiver authenticator, time 
stamp generator 26 of accepting device 5-5 generates a 
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second time stamp representative of the time when the re- 
ceiver verifier from receiving apparatus 2 is received 
(step A30) . 

At this time, signature verifier 24 of accept- 
5 ing device 5-5 refers to database 28 of accepting device 
5-5, and checks the receiver authenticator against the 
public key certificate of receiving apparatus 2 to deter- 
mine whether the receiver authenticator matches the public 
key certificate of receiving apparatus 2 or not (step 
10 A31). 

If the receiver authenticator matches the pub- 
lic key certificate of receiving apparatus 2, then signa- 
ture unit 23 of accepting device 5-5 adds the receiver au- 
thenticator and the second time stamp to the fifth elec- 

15 tronic document, generating a hash value. Signature unit 
23 of accepting device 5-5 signs the hash value with the 
private key of accepting device 5-5, generating a sixth 
electronic document that comprises the fifth electronic 
document, the receiver authenticator, and the second time 

20 stamp, with the signature of accepting device 5-5 assigned 
thereto (step A32, see Fig. 9) . For generating such a 
sixth electronic document, the second time stamp may be 
dispensed with. Transmitter 21 of accepting device 5-5 
then transmits the sixth electronic document to receiving 

25 apparatus 2 (step A33) . 
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If the receiver authenticator does not match 
the public key certificate of receiving apparatus 2, then 
transmitter 21 of accepting device 5-5 transmits informa- 
tion indicative of the match failure to receiving appara- 
5 tus 2. Based on the information, receiving apparatus 2 
transmits again the receiver authenticator to accepting 
device 5-5. Accepting device 5-5 checks the receiver au- 
thenticator again. If the receiver authenticator does not 
match the public key certificate, then accepting device 5- 

10 5 transmits information indicating that the fifth elec- 
tronic document (the first electronic document) cannot be 
transmitted to transmitting apparatus 1 (these steps are 
not illustrated) . 

Receiver 12 of receiving apparatus 2 receives 

15 the sixth electronic document from accepting device 5-5. 
When receiver 12 receives the sixth electronic document, 
signature verifier 14 of receiving apparatus 2 refers to 
database 18 of receiving apparatus 2, and checks the sig- 
nature of the sixth electronic document against the public 

20 key certificate of accepting device 5-5 to determine 

whether the signature of the sixth electronic document 
matches the public key certificate of accepting device 5-5 
or not (step A34 ) . 

If the signature of the sixth electronic docu- 

25 ment matches the public key certificate of accepting de- 
vice 5-5, then register 17 of receiving apparatus 2 stores 



the sixth electronic document in memory apparatus 4 (step 
A35) . The sixth electronic document is the first elec- 
tronic document to which the sender authenticator , the 
signatures (accepting device 5-1, relay device 5-2, relay 
5 device 5-3, relay device 5-4, and accepting device 5-5), 
and the receiver authenticator are assigned. With the 
electronic data transmission and reception system accord- 
ing to the present invention, since the sixth electronic 
document is stored in memory apparatus 4, the receiver who 

10 uses receiving apparatus 2 is unable to repudiate that the 
receiver has received the first electronic document (re- 
ception denial) . 

If the signature of the sixth electronic docu- 
ment does not match the public key certificate of accept- 

15 ing device 5-5, then transmitter 11 of receiving apparatus 
2 transmits information indicative of the match failure to 
accepting device 5-5. Based on the information, accepting 
device 5-5 transmits again the sixth electronic document 
to receiving apparatus 2. Receiving apparatus 2 checks 

20 the sixth electronic document again. If the signature of 
the sixth electronic document does not match the public 
key certificate, then accepting device 5-5 transmits in- 
formation indicating that the sixth electronic document 
(the first electronic document) cannot be transmitted to 

25 transmitting apparatus 1 (these steps are not illus- 
trated) . 
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Proof data generator 25 of accepting device 5-5 
adds the receiver authenticator and the second time stamp 
to the fifth electronic document, generating a hash value. 
Proof data generator 25 of accepting device 5-5 signs the 
hash value with the private key of accepting device 5-5, 
generating reception proof data which are electronic data 
comprising the fifth electronic document, the receiver au- 
thenticator, and the second time stamp, with the signature 
of accepting device 5-5 assigned thereto (step A36, see 
Fig. 10) . For generating such reception proof data, the 
second time stamp may be dispensed with. 

Transmitter 21 of accepting device 5-5 trans- 
mits the reception proof data to transmitting apparatus 1 
(step A37) . The reception proof data are transmitted from 
accepting device 5-5 through relay device 5-4, relay de- 
vice 5-3, relay device 5-2, and accepting device 5-1 to 
transmitting apparatus 1. Alternatively, the reception 
proof data are directly transmitted from accepting device 
5-5 to transmitting apparatus 1. 

Receiver 12 of transmitting apparatus 1 re- 
ceives the reception proof data from accepting device 5-5. 
When receiver 12 receives the reception proof data, signa- 
ture verifier 14 of transmitting apparatus 1 refers to da- 
tabase 18 of transmitting apparatus 1, and checks the sig- 
nature of the reception proof data against the public key 
certificate of accepting device 5-5 to determine whether 
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the signature of the reception proof data matches the pub- 
lic key certificate of accepting device 5-5 or not (step 
A38) . 

If the signature of the reception proof data 
5 matches the public key certificate of accepting device 5- 
5, then register 17 of transmitting apparatus 1 stores the 
reception proof data in memory apparatus 3 (step A39) . 

If the signature of the reception proof data 
does not match the public key certificate of accepting de- 

10 vice 5-5, then transmitter 11 of receiving apparatus 2 

transmits information indicative of the match failure to 
accepting device 5-5, Based on the information, accepting 
device 5-5, transmits again the reception proof data to 
receiving apparatus 2. Receiving apparatus 2 checks the 

15 signature of the reception proof data again. If the sig- 
nature of the reception proof data does not match the pub- 
lic key certificate, then receiving apparatus 2 transmits 
information indicating that it will not accept the sixth 
electronic document (the first electronic document) even 

20 when it receives the sixth electronic document, to trans- 
mitting apparatus 1 (these steps are not illustrated) . 

With the electronic data transmission and re- 
ception system according to the present invention, because 
of the sender authenticator , the signatures (accepting de- 

25 vice 5-1, relay device 5-2, relay device 5-3, relay device 
5-4, and accepting device 5-5) that have been assigned un- 
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til the sixth electronic document is generated, and the 
receiver authenticator, the sender who has transmitted the 
first electronic document using transmitting apparatus 1 
is unable to repudiate that the sender has transmitted the 
5 first electronic document (transmission denial) . Further- 
more, the receiver who uses receiving apparatus 2 is un- 
able to repudiate that the receiver has received the first 
electronic document (reception denial). Therefore, the 
electronic data transmission and reception system accord- 
10 ing to the present invention guarantees the first elec- 
tronic document transmitted from transmitting apparatus 1 
until they are received by receiving apparatus 2. 

Verification of the sixth electronic document 
with receiving apparatus 2 will be described below. 
15 As shown in Fig. 11, electronic document veri- 

fier 15 of receiving apparatus 2 refers to database 18 of 
receiving apparatus 2, and checks the signature of the 
sixth electronic document stored in memory apparatus 4 
against the public key certificate of accepting device 5-5 
20 to determine whether the signature of the sixth electronic 
document matches the public key certificate of accepting 
device 5-5 or not (step Bl) . 

As a result, electronic document verifier 15 of 
receiving apparatus 2 fetches the fifth electronic docu- 
25 ment, the receiver authenticator, and the second time 

stamp, except the signature of accepting device 5-5 that 
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is assigned to the sixth electronic document which matches 
the public key certificate of accepting device 5-5 (step 

B2, see Fig. 9) . 

Electronic document verifier 15 of receiving 
apparatus 2 refers to database 18 of receiving apparatus 
2, and checks the signature of the fifth electronic docu- 
ment against the public key certificate of accepting de- 
vice 5-4 to determine whether the signature of the fifth 
electronic document matches the public key certificate of 
accepting device 5-4 or not (step B3) . 

As a result, electronic document verifier 15 of 
receiving apparatus 2 fetches the fourth electronic docu- 
ment except the signature of accepting device 5-4 that is 
assigned to the fifth electronic document which matches 
the public key certificate of accepting device 5-4 (step 

B4, see Fig. 9) . 

Electronic document verifier 15 of receiving 
apparatus 2 refers to database 18 of receiving apparatus 
2, and checks the signature of the fourth electronic docu- 
ment against the public key certificate of accepting de- 
vice 5-3 to determine whether the signature of the fourth 
electronic document matches the public key certificate of 
accepting device 5-3 or not (step B5) . 

Since the signature of the fourth electronic 
document matches the public key certificate of accepting 
device 5-3, electronic document verifier 15 of receiving 
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apparatus 2 fetches the third electronic document except 
the signature of accepting device 5-3 that is assigned to 
the fourth electronic document (step B6, see Fig. 9) . 

Electronic document verifier 15 of receiving 
5 apparatus 2 refers to database 18 of receiving apparatus 
2, and checks the signature of the third electronic docu- 
ment against the public key certificate of accepting de- 
vice 5-2 to determine whether the signature of the third 
electronic document matches the public key certificate of 
10 accepting device 5-2 or not (step B7) , 

Since the signature of the third electronic 
document matches the public key certificate of accepting 
device 5-2, electronic document verifier 15 of receiving 
apparatus 2 fetches the second electronic document except 
15 the signature of accepting device 5-2 that is assigned to 
the third electronic document (step B8, see Fig. 9) . 

Electronic document verifier 15 of receiving 
apparatus 2 refers to database 18 of receiving apparatus 
2, and checks the signature of the second electronic docu- 
20 ment against the public key certificate of accepting de- 
vice 5-1 to determine whether the signature of the second 
electronic document matches the public key certificate of 
accepting device 5-1 or not (step B9) . 

Since the signature of the second electronic 
25 document matches the public key certificate of accepting 
device 5-1, electronic document verifier 15 of receiving 
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apparatus 2 fetches the first electronic document, the 
sender authenticator , and the first time stamp, except the 
signature of accepting device 5-1 that is assigned to the 
second electronic document (step BIO, see Fig. 9) . 

Electronic document verifier 15 of receiving 
apparatus 2 refers to database 18 of receiving apparatus 
2, and checks the sender authenticator against the public 
key certificate of transmitting apparatus 1 to determine 
whether the sender authenticator matches the public key 
certificate of transmitting apparatus 1 or not (step Bll) . 

Since the sender authenticator matches the pub- 
lic key certificate of transmitting apparatus 1, elec- 
tronic document verifier 15 of receiving apparatus 2 rec- 
ognizes that the transmitting apparatus 1 has transmitted 
15 the first electronic document (step B12) . 

As described above, if receiving apparatus 2 
properly confirms (verifies) the sixth electronic docu- 
ment, the fifth electronic document, the fourth electronic 
document, the third electronic document, the second elec- 
20 tronic document, and the first electronic document in that 
order, then the electronic data transmission and reception 
system according to the present invention guarantees that 
the first electronic document has been transmitted by 
transmitting apparatus 1. Furthermore, receiving appara- 
25 tus 2 can verify the route (transmitting apparatus 1, ac- 
cepting device 5-1, relay device 5-2, relay device 5-3, 
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relay device 5-4, accepting device 5-5, and receiving ap- 
paratus 2) along which the first electronic document has 
been transmitted to receiving apparatus 2, as the histori- 
cal record of signatures. The sender can confirm the 
5 route off-line. Receiving apparatus 2 can confirm off- 
line the route along which the first electronic document 
has been transmitted, without the need for communicating 
with and collecting logs from accepting device 5-1, relay 
device 5-2, relay device 5-3, relay device 5-4, and ac- 

10 cepting device 5-5. Therefore, accepting device 5-1, re- 
lay device 5-2, relay device 5-3, relay device 5-4, and 
accepting device 5-5 are not required to store logs, and 
do not need any memory apparatus for storing logs. The 
electronic data transmission and reception system accord- 

15 ing to the present invention protects itself against ille- 
gal access by a hacker as the route is grasped by receiv- 
ing apparatus 2 . 

Verification of the reception proof data with 
transmitting apparatus 1 will be described below. 

20 As shown in Fig. 12, electronic document veri- 

fier 15 of transmitting apparatus 1 refers to database 18 
of transmitting apparatus 1, and checks the signature of 
the reception proof data stored in memory apparatus 3 
against the public key certificate of accepting device 5-5 

25 to determine whether the signature of the reception proof 
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data matches the public key certificate of accepting de- 
vice 5-5 or not (step CI) . 

Since the signature of the reception proof data 
matches the public key certificate of accepting device 5- 
5, electronic document verifier 15 of transmitting appara- 
tus 1 fetches the fifth electronic document, the receiver 
authenticator, and the second time stamp, except the sig- 
nature of accepting device 5-5 that is assigned to the re- 
ception proof data (step C2, see Fig. 10) . 

Electronic document verifier 15 of transmitting 
apparatus 1 refers to database 18 of transmitting appara- 
tus 1, and checks the receiver authenticator against the 
public key certificate of receiving apparatus 2 to deter- 
mine whether the receiver authenticator matches the public 
key certificate of receiving apparatus 2 or not (step C3) . 

Since the receiver authenticator matches the 
public key certificate of receiving apparatus 2, elec- 
tronic document verifier 15 of transmitting apparatus 1 
refers to database 18 of transmitting apparatus 1, and 
checks the signature of the fifth electronic document 
against the public key certificate of accepting device 5-4 
to determine whether the signature of the fifth electronic 
document matches the public key certificate of accepting 
device 5-4 or not (step C4) . 

Since the signature of the fifth electronic 
document matches the public key certificate of accepting 



device 5-4, electronic document verifier 15 of transmit- 
ting apparatus 1 fetches the fourth electronic document 
except the signature of accepting device 5-4 that is as- 
signed to the fifth electronic document (step C5, see Fig. 
5 10) . 

Electronic document verifier 15 of transmitting 
apparatus 1 refers to database 18 of transmitting appara- 
tus 1, and checks the signature of the fourth electronic 
document against the public key certificate of accepting 

10 device 5-3 to determine whether the signature of the 

fourth electronic document matches the public key certifi- 
cate of accepting device 5-3 or not (step C6) . 

Since the signature of the fourth electronic 
document matches the public key certificate of accepting 

15 device 5-3, electronic document verifier 15 of transmit- 
ting apparatus 1 fetches the third electronic document ex- 
cept the signature of accepting device 5-3 that is as- 
signed to the fourth electronic document (step CI, see 
Fig. 10) . 

20 Electronic document verifier 15 of transmitting 

apparatus 1 refers to database 18 of transmitting appara- 
tus 1, and checks the signature of the third electronic 
document against the public key certificate of accepting 
device 5-2 to determine whether the signature of the third 

25 electronic document matches the public key certificate of 
accepting device 5-2 or not (step C8) . 
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Since the signature of the third electronic 
document matches the public key certificate of accepting 
device 5-2, electronic document verifier 15 of transmit- 
ting apparatus 1 fetches the second electronic document 
except the signature of accepting device 5-2 that is as- 
signed to the third electronic document (step C9, see Fig. 
10) . 

Electronic document verifier 15 of transmitting 
apparatus 1 refers to database 18 of transmitting appara- 
tus 1, and checks the signature of the second electronic 
document against the public key certificate of accepting 
device 5-1 to determine whether the signature of the sec- 
ond electronic document matches the public key certificate 
of accepting device 5-1 or not (step CIO) . 

Since the signature of the second electronic 
document matches the public key certificate of accepting 
device 5-1, electronic document verifier 15 of transmit- 
ting apparatus 1 fetches the first electronic document ex- 
cept the signature of accepting device 5-1 that is as- 
signed to the second electronic document (step Cll, see 
Fig. 10) . 

Electronic document verifier 15 of transmitting 
apparatus 1 refers to memory apparatus 3, and checks the 
fetched first electronic document against the storage 
electronic document (the first electronic document) stored 
in memory apparatus 3 to determine whether the fetched 
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first electronic document matches the storage electronic 
document or not (step C12) . 

Since the fetched first electronic document 
matches the storage electronic document, electronic docu- 
ment verifier 15 of transmitting apparatus 1 recognizes 
that the first electronic document has been transmitted to 
receiving apparatus 2 without being falsified (step C13) . 

As described above, if transmitting apparatus 1 
properly confirms (verifies) the reception proof data, the 
fifth electronic document, the fourth electronic document, 
the third electronic document, the second electronic docu- 
ment, and the first electronic document in that order, 
then the electronic data transmission and reception system 
according to the present invention guarantees that the 
first electronic document has been received by receiving 
apparatus 2. Furthermore, transmitting apparatus 1 can 
detect a falsification of the first electronic document by 
comparing the fetched first electronic document with the 
storage electronic document (the first electronic docu- 
ment) stored in memory apparatus 3. The electronic data 
transmission and reception system according to the present 
invention can verify the route (transmitting apparatus 1, 
accepting device 5-1, relay device 5-2, relay device 5-3, 
relay device 5-4, accepting device 5-5, and receiving ap- 
paratus 2) along which the first electronic document has 
been transmitted to receiving apparatus 2, as the histori- 
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cal record of signatures. The sender can confirm the 
route off-line. Transmitting apparatus 1 can confirm off- 
line the route along which the first electronic document 
has been transmitted, without the need for communicating 
with and collecting logs from accepting device 5-1, relay 
device 5-2, relay device 5-3, relay device 5-4, and ac- 
cepting device 5-5. Therefore, accepting device 5-1, re- 
lay device 5-2, relay device 5-3, relay device 5-4, and 
accepting device 5-5 are not required to store logs, and 
do not need any memory apparatus for storing logs. The 
electronic data transmission and reception system accord- 
ing to the present invention protects itself against ille- 
gal access by a hacker as the route is grasped by trans- 
mitting apparatus 1. 

If reception proof data are generated in step 
A36, then electronic documents may be dispensed with (see 
Fig. 14) . 

Specifically, as shown in Fig. 13, after proof 
data generator 25 of accepting device 5-5 generates recep- 
tion proof data in step A36, it deletes the first elec- 
tronic data from the reception proof data (step A40) . 
Transmitter 21 of accepting device 5-5 transmits the re- 
ception proof data from which the first electronic data 
has been deleted to transmitting apparatus 1 in step A37 . 

Receiver 12 of transmitting apparatus 1 re- 
ceives the reception proof data from which the first elec- 
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tronic data has been deleted from accepting device 5-5. 
At this time, signature verifier 14 of transmitting appa- 
ratus 1 adds the storage electronic document (the first 
electronic document) stored in memory apparatus 3 to the 
5 reception proof data from which the first electronic data 
has been deleted, thus restoring the reception proof data 
(step A41) . Thereafter, transmitting apparatus 1 executes 
steps A38, A39, CI - C13. 

While a preferred embodiment of the present in- 
10 vention has been described using specific terms, such de- 
scription is for illustrative purposes only, and it is to 
be understood that changes and variations may be made 
without departing from the spirit or scope of the follow- 
ing claims. 
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